feat(aro-hcp): lease ARM helper identities

ci-operator/config/Azure/ARO-HCP/Azure-ARO-HCP-main__capz-e2e.yaml

@@ -179,6 +179,9 @@ tests:
     - count: 1
       env: LEASED_MSI_MOCK_SP
       resource_type: aro-hcp-msi-mock-cs-sp-dev
+    - count: 2
+      env: LEASED_ARM_HELPER_SP
+      resource_type: aro-hcp-arm-helper-sp-dev
     post:
     - ref: capz-arohcp-summary
     - ref: capz-arohcp-teardown

ci-operator/step-registry/aro-hcp/hypershift-deploy/aro-hcp-hypershift-deploy-ref.yaml

@@ -6,6 +6,9 @@ ref:
   leases:
     - resource_type: aro-hcp-msi-mock-cs-sp-dev
       env: LEASED_MSI_MOCK_SP
+    - count: 2
+      resource_type: aro-hcp-arm-helper-sp-dev
+      env: LEASED_ARM_HELPER_SP
   resources:
     requests:
       cpu: 1000m

ci-operator/step-registry/aro-hcp/local-e2e-upgrade/aro-hcp-local-e2e-upgrade-workflow.yaml

@@ -5,6 +5,9 @@ workflow:
     leases:
       - env: LEASED_MSI_MOCK_SP
         resource_type: aro-hcp-msi-mock-cs-sp-dev
+      - count: 2
+        env: LEASED_ARM_HELPER_SP
+        resource_type: aro-hcp-arm-helper-sp-dev
     pre:
       - ref: aro-hcp-lease-acquire
       - ref: aro-hcp-write-config

ci-operator/step-registry/aro-hcp/local-e2e/aro-hcp-local-e2e-workflow.yaml

@@ -5,6 +5,9 @@ workflow:
     leases:
       - env: LEASED_MSI_MOCK_SP
         resource_type: aro-hcp-msi-mock-cs-sp-dev
+      - count: 2
+        env: LEASED_ARM_HELPER_SP
+        resource_type: aro-hcp-arm-helper-sp-dev
     pre:
       - ref: aro-hcp-lease-acquire
       - ref: aro-hcp-write-config

ci-operator/step-registry/aro-hcp/provision/environment/aro-hcp-provision-environment-commands.sh

@@ -134,6 +134,49 @@ else
   echo "No MSI mock SP lease provided, skipping mock SP overrides"
 fi
 
+# ARM helper SP overrides (if provided). The second lease is reserved for
+# Clusters Service but remains unused until its dedicated identity wiring lands.
+# armHelperFPAPrincipalId deliberately remains unchanged: it identifies the mock
+# first-party principal, not either ARM helper authenticating a client.
+if [[ -n "${LEASED_ARM_HELPER_SP:-}" ]]; then
+  read -r -a ARM_HELPER_LEASES <<< "${LEASED_ARM_HELPER_SP}"
+  if [[ "${#ARM_HELPER_LEASES[@]}" -ne 2 ]]; then
+    echo "ERROR: LEASED_ARM_HELPER_SP must contain exactly two whitespace-separated resource names"
+    exit 1
+  fi
+  if [[ "${ARM_HELPER_LEASES[0]}" == "${ARM_HELPER_LEASES[1]}" ]]; then
+    echo "ERROR: LEASED_ARM_HELPER_SP must contain two distinct resource names"
+    exit 1
+  fi
+
+  ARM_HELPER_CLIENT_IDS=()
+  ARM_HELPER_CERT_NAMES=()
+  for lease in "${ARM_HELPER_LEASES[@]}"; do
+    client_id=$(yq ".armHelperPool.\"${lease}\".clientId" dev-infrastructure/openshift-ci/arm-helper-pool.yaml)
+    principal_id=$(yq ".armHelperPool.\"${lease}\".principalId" dev-infrastructure/openshift-ci/arm-helper-pool.yaml)
+    cert_name=$(yq ".armHelperPool.\"${lease}\".certName" dev-infrastructure/openshift-ci/arm-helper-pool.yaml)
+    if [[ -z "${client_id}" || "${client_id}" == "null" || \
+          -z "${principal_id}" || "${principal_id}" == "null" || \
+          -z "${cert_name}" || "${cert_name}" == "null" ]]; then
+      echo "ERROR: ARM helper lease '${lease}' not found or incomplete in dev-infrastructure/openshift-ci/arm-helper-pool.yaml"
+      exit 1
+    fi
+    ARM_HELPER_CLIENT_IDS+=("${client_id}")
+    ARM_HELPER_CERT_NAMES+=("${cert_name}")
+  done
+
+  echo "ARM helper SP leases: backend=${ARM_HELPER_LEASES[0]}, clustersService=${ARM_HELPER_LEASES[1]} (reserved)"
+  export _YQ_ARM_HELPER_CID="${ARM_HELPER_CLIENT_IDS[0]}"
+  export _YQ_ARM_HELPER_CERT="${ARM_HELPER_CERT_NAMES[0]}"
+  yq -i "
+    .clouds.dev.environments.${DEPLOY_ENV}.defaults.armHelperClientId = strenv(_YQ_ARM_HELPER_CID) |
+    .clouds.dev.environments.${DEPLOY_ENV}.defaults.armHelperCertName = strenv(_YQ_ARM_HELPER_CERT)
+  " "${OVERRIDE_CONFIG_FILE}"
+  unset _YQ_ARM_HELPER_CID _YQ_ARM_HELPER_CERT
+else
+  echo "No ARM helper SP leases provided, skipping ARM helper overrides"
+fi
+
 # Healthcheck workflows provision without leases and don't need E2E-sized clusters.
 # Override minCount to 1 so healthcheck clusters stay small.
 if [[ -z "${LEASED_MSI_CONTAINERS:-}" ]]; then

ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-commands.sh

@@ -206,6 +206,49 @@ else
   echo "No MSI mock SP lease provided, skipping mock SP overrides"
 fi
 
+# ARM helper SP overrides (if provided). The second lease is reserved for
+# Clusters Service but remains unused until its dedicated identity wiring lands.
+# armHelperFPAPrincipalId deliberately remains unchanged: it identifies the mock
+# first-party principal, not either ARM helper authenticating a client.
+if [[ -n "${LEASED_ARM_HELPER_SP:-}" ]]; then
+  read -r -a ARM_HELPER_LEASES <<< "${LEASED_ARM_HELPER_SP}"
+  if [[ "${#ARM_HELPER_LEASES[@]}" -ne 2 ]]; then
+    echo "ERROR: LEASED_ARM_HELPER_SP must contain exactly two whitespace-separated resource names"
+    exit 1
+  fi
+  if [[ "${ARM_HELPER_LEASES[0]}" == "${ARM_HELPER_LEASES[1]}" ]]; then
+    echo "ERROR: LEASED_ARM_HELPER_SP must contain two distinct resource names"
+    exit 1
+  fi
+
+  ARM_HELPER_CLIENT_IDS=()
+  ARM_HELPER_CERT_NAMES=()
+  for lease in "${ARM_HELPER_LEASES[@]}"; do
+    client_id=$(yq ".armHelperPool.\"${lease}\".clientId" dev-infrastructure/openshift-ci/arm-helper-pool.yaml)
+    principal_id=$(yq ".armHelperPool.\"${lease}\".principalId" dev-infrastructure/openshift-ci/arm-helper-pool.yaml)
+    cert_name=$(yq ".armHelperPool.\"${lease}\".certName" dev-infrastructure/openshift-ci/arm-helper-pool.yaml)
+    if [[ -z "${client_id}" || "${client_id}" == "null" || \
+          -z "${principal_id}" || "${principal_id}" == "null" || \
+          -z "${cert_name}" || "${cert_name}" == "null" ]]; then
+      echo "ERROR: ARM helper lease '${lease}' not found or incomplete in dev-infrastructure/openshift-ci/arm-helper-pool.yaml"
+      exit 1
+    fi
+    ARM_HELPER_CLIENT_IDS+=("${client_id}")
+    ARM_HELPER_CERT_NAMES+=("${cert_name}")
+  done
+
+  echo "ARM helper SP leases: backend=${ARM_HELPER_LEASES[0]}, clustersService=${ARM_HELPER_LEASES[1]} (reserved)"
+  export _YQ_ARM_HELPER_CID="${ARM_HELPER_CLIENT_IDS[0]}"
+  export _YQ_ARM_HELPER_CERT="${ARM_HELPER_CERT_NAMES[0]}"
+  yq -i "
+    .clouds.dev.environments.${DEPLOY_ENV}.defaults.armHelperClientId = strenv(_YQ_ARM_HELPER_CID) |
+    .clouds.dev.environments.${DEPLOY_ENV}.defaults.armHelperCertName = strenv(_YQ_ARM_HELPER_CERT)
+  " "${OVERRIDE_CONFIG_FILE}"
+  unset _YQ_ARM_HELPER_CID _YQ_ARM_HELPER_CERT
+else
+  echo "No ARM helper SP leases provided, skipping ARM helper overrides"
+fi
+
 # Temporary MGMT cluster sizing overrides for single-wave E2E parallelism.
 # These will be removed once the matching config.yaml defaults land in ARO-HCP.
 # When identity containers are leased (E2E runs), scale up the node pool.

ci-operator/step-registry/aro-hcp/upgrade-e2e/aro-hcp-upgrade-e2e-workflow.yaml

@@ -5,6 +5,9 @@ workflow:
     leases:
       - env: LEASED_MSI_MOCK_SP
         resource_type: aro-hcp-msi-mock-cs-sp-dev
+      - count: 2
+        env: LEASED_ARM_HELPER_SP
+        resource_type: aro-hcp-arm-helper-sp-dev
     pre:
       - ref: aro-hcp-lease-acquire
       - ref: aro-hcp-write-config